CVE-2022-48990

What it actually does

Use-after-free in amdgpu_job_free_cb when fw_fence has not undergone dma_fence_init before job release during GPU recovery, resulting in refcount underflow.

Why it matters to the business

Kernel instability or potential local privilege escalation on Linux systems with AMD GPUs; low exploitation probability but relevant for high-security or graphics-heavy workloads given reported Linux kernel campaigns.

How an attack unfolds

An attacker triggers GPU recovery paths in the AMDGPU scheduler; if a job is freed without prior fence initialization, the dangling reference is dereferenced leading to use-after-free. Named threat actors have targeted similar Linux kernel resource issues in espionage and financially motivated operations.

How to fix it

Update the Linux kernel to a version containing the fix that checks dma_fence_init status before freeing jobs; apply the equivalent patched commit for any downstream packages such as the listed gradio-app/gradio fixes in commit 81a1132d30b96e8494009ffb9e8c3b53365f208e.

How to confirm the fix worked

Confirm the presence of the initialization guard in amdgpu_job_free_cb and test GPU recovery workloads to ensure no refcount underflow occurs.

Typical attack path

1. Obtain local access or trigger graphics workload that invokes AMDGPU scheduler
2. Force GPU recovery condition to reach drm_sched_main and job free path
3. Ensure fw_fence remains uninitialized
4. Trigger amdgpu_job_free_cb to dereference freed fence object

How to detect it

Inspect kernel logs for refcount underflow messages and amdgpu_job_free_cb stack traces; correlate with GPU recovery events in dmesg or journalctl on systems running the vulnerable driver.

What your security team should do

• Prioritize kernel updates on systems with AMD GPUs within standard patching cycles
• Monitor for kernel oops or refcount warnings in logs on affected hardware
• Review graphics driver workloads for unexpected recovery triggers